From f892dc6a196cd77826cd592b31cfd5cf1d60b004 Mon Sep 17 00:00:00 2001 From: iris Date: Mon, 12 Oct 2026 00:45:16 +0200 Subject: [PATCH] nix: comments no longer say a hive's bao identity reads swarm/services/* The hive's bao policy grants read on swarm/agents/* and swarm/hives//* only. Five comments across four modules still listed swarm/services/* among its reads, or said a shared leaf would let a unit fetch another service's OIDC client secret, or that the hive's leaf reads every secret in the store. Comment and option-description text only. --- nix/host-modules/glue-queue-agent-credential.nix | 4 ++-- nix/host-modules/swarm-bao.nix | 13 +++++++------ nix/host-modules/swarm-grafana.nix | 4 ++-- nix/host-modules/swarm-otel.nix | 4 ++-- 4 files changed, 13 insertions(+), 12 deletions(-) diff --git a/nix/host-modules/glue-queue-agent-credential.nix b/nix/host-modules/glue-queue-agent-credential.nix index b38b5914..165ff565 100644 --- a/nix/host-modules/glue-queue-agent-credential.nix +++ b/nix/host-modules/glue-queue-agent-credential.nix @@ -45,8 +45,8 @@ let # 🩸 This principal's OWN leaf, not `clientCertFile` — the hive's. Bao # matches a cert-auth role on the CN, so one leaf shared by four readers # would be ONE principal holding the union of four grants: read on - # `swarm/agents/*` AND `swarm/hives//*` AND `swarm/services/*`, when - # this unit reads one queue credential and nothing else. Its own leaf carries + # `swarm/agents/*` AND `swarm/hives//*`, when this unit reads one + # queue credential and nothing else. Its own leaf carries # `-` and its role grants the single path # below — still this hive's own, so the narrowing costs no reach. haveClientIdentity = diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix index 8b152347..b26780e0 100644 --- a/nix/host-modules/swarm-bao.nix +++ b/nix/host-modules/swarm-bao.nix @@ -802,12 +802,13 @@ let # 🩸 Each of these reads exactly ONE path in the store, and does it holding # its own leaf rather than `deploy.bao.clientCertFile` — the hive's own leaf, # whose policy (`swarm-secret-client`'s `policy::render`) grants read on - # `swarm/agents/*`, `swarm/hives//*` AND `swarm/services/*`. + # `swarm/agents/*` AND `swarm/hives//*`, and nothing under + # `swarm/services/`. # Principals presenting one certificate are ONE principal to bao, so sharing - # the hive's leaf would leave only the union of what they need expressible: - # the unit that fetches Grafana's OIDC client secret could fetch every agent - # credential in the swarm, and the unit that fetches this hive's queue - # credential could fetch Grafana's. + # the hive's leaf would give each of them everything that leaf reads: the + # unit that fetches this hive's queue credential could fetch every agent + # credential in the swarm, and a unit that fetches a service's OIDC client + # secret could not fetch it at all, as that path is not the hive's to read. # # Each gets its own leaf, its own cert-auth role and a policy holding the # one `secret/data/…` path that principal's script actually names — spelled @@ -1885,7 +1886,7 @@ in ⚠️ **Not** {option}`services.hyperhive.deploy.bao.clientCertFile`. Pointing this at the hive's own leaf would evaluate, deploy and log in — and hand a unit that reads one credential a certificate that reads every - secret in the store. + agent credential in the swarm and this hive's own secrets. No default here: ./glue-bao-tls.nix points it at the leaf it mints, wherever this host mints its own PKI. A deployment that reads a store on diff --git a/nix/host-modules/swarm-grafana.nix b/nix/host-modules/swarm-grafana.nix index c2a9ad30..15d03ace 100644 --- a/nix/host-modules/swarm-grafana.nix +++ b/nix/host-modules/swarm-grafana.nix @@ -218,8 +218,8 @@ let # 🩸 Grafana's OWN leaf, not `clientCertFile` — the hive's. Bao matches a # cert-auth role on the CN, so one leaf shared by four readers would be ONE # principal holding the union of four grants: this unit could read every - # agent credential in the swarm and every other service's OIDC client - # secret, when what it needs is the one path `storeSecretPath` names. + # agent credential in the swarm, when what it needs is the one path + # `storeSecretPath` names. haveClientIdentity = baoDeploy.grafanaOidcClientCertFile != null && baoDeploy.grafanaOidcClientKeyFile != null; diff --git a/nix/host-modules/swarm-otel.nix b/nix/host-modules/swarm-otel.nix index b19e69e6..f281668f 100644 --- a/nix/host-modules/swarm-otel.nix +++ b/nix/host-modules/swarm-otel.nix @@ -253,8 +253,8 @@ let # 🩸 The collector's OWN leaf, not `clientCertFile` — the hive's. Bao # matches a cert-auth role on the CN, so one leaf shared by four readers # would be ONE principal holding the union of four grants: this unit could - # read every agent credential in the swarm and Grafana's OIDC client - # secret, when what it needs is the one path `storeSecretPath` names. + # read every agent credential in the swarm, when what it needs is the one + # path `storeSecretPath` names. haveClientIdentity = baoDeploy.otelOidcClientCertFile != null && baoDeploy.otelOidcClientKeyFile != null;